Our office uses a Windows Domain with Active Directory to manage user access to machines and network resources. The IT staff maintains a record of everyone user's password, which is used mainly for troubleshooting. E.g. sometimes problems appear only when logged in as a "regular" user, not an admin. Also, this lets IT admins configure software for local users, check settings, etc.
Is it considered bad practice to keep this list of passwords? In theory, only administrators have access to it. Is there some way to use admin credentials to log in as a local user, which would obviate the need to store the user's password?
(A little background: the office has about 30 users, with 2 IT admins. Some users have remote access via VPN.)